skills.rest
dgethings
dgethingsCOMMUNITY
Explore all skills by this author →
GitHub

ise-incident-response

Automate ISE endpoint incident investigation and quarantine workflow with ServiceNow incident creation.

Updated Feb 28, 2026
Search Tags:#mcp#endpoint#incident#servicenow#quarantine#security-operations#ise
One-click install
npx skills add https://github.com/dgethings/netclaw --skill ise-incident-response-dgethings
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ise-incident-response
Source: https://github.com/dgethings/netclaw/tree/main/workspace/skills/ise-incident-response
Command: npx skills add https://github.com/dgethings/netclaw --skill ise-incident-response-dgethings

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a disciplined, human-guided workflow for investigating suspected endpoint compromises managed by Cisco ISE, collecting endpoint data, history, posture, and evidence, and coordinating with ServiceNow for incident tracking and optional quarantine decisions.

Core Features & Use Cases

  • Endpoint lookup and active session retrieval to establish scope of an incident.
  • Authentication history and posture review to determine risk and access levels.
  • Human-in-the-loop quarantine decisions with ServiceNow incident creation.

Quick Start

Run the ISE incident response workflow to start an investigation using the MCP interface.

Frequently Asked Questions about ise-incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Cisco ISE endpoint incident investigation and quarantine?▼

You can automate ISE incident investigation by running a human-guided workflow that performs endpoint lookup, retrieves active sessions, reviews authentication history, and executes human-approved quarantine decisions.

Can I create a ServiceNow incident directly from an ISE unauthorized device detection?▼

Yes, the ISE incident response workflow integrates with ServiceNow to automatically create an incident ticket while collecting endpoint posture and authentication evidence for tracking.

What do I need to run an ISE endpoint quarantine workflow with ServiceNow integration?▼

You need Python 3 and three configured environment variables: ISE_MCP_SCRIPT, ISE_BASE, and SERVICENOW_MCP_SCRIPT to successfully execute the MCP tools for endpoint quarantine.

How does the SOC alert workflow handle endpoint posture and authentication history review?▼

The workflow retrieves endpoint posture assessments and authentication history to determine risk levels and access scope, establishing the full context of the incident before proceeding to quarantine.

Does the ISE quarantine process require human approval before isolating a compromised endpoint?▼

Yes, the quarantine process is human-in-the-loop, requiring explicit human approval before isolating a suspected compromised endpoint managed by Cisco ISE.

Related Skills

Explore More Legal & Compliance Skills→
automateyournetworkautomateyournetwork
627

ise-posture-audit

Audit Cisco ISE authorization policies, posture compliance, and TrustSec segmentation.

Community
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

incident-summarization

Generate executive and technical security incident reports with MITRE ATT&CK mappings.

Official
Intermediate
automateyournetworkautomateyournetwork
627

ise-incident-response

Automate Cisco ISE endpoint investigation and quarantine with ServiceNow incident creation.

Community
Advanced
groeimetaigroeimetai
77

performance-analytics

Creates and configures ServiceNow Performance Analytics indicators, breakdowns, thresholds, widgets, and dashboards via MCP tools.

Community
Advanced